BrowserBackdoor - Secure JavaScript WebSocket Backdoor and a Ruby Command-Line Listener

BrowserBackdoor is an Electron application that uses a JavaScript WebSocket Backdoor to connect to the listener. BrowserBackdoorServer is a WebSocket server that listens for incoming WebSocket connections and creates a command-line interface for sending commands to the remote system. The JavaScri...

LocalTapiola: DOM XSS bypassing in Regional Office -selector

Issue A previous report https://hackerone.com/reports/127077 led the reporter to do some further investigation. During the investigation, a DOM XSS was found in one of the javascript libraries used on www.lahitapiola.fi. The report contained a brief PoC and a screenshot as proof. Fix The issue wa...

Python Based Windows Backdoor with Gmail C&C: gDog

A stealthy Python based Windows backdoor that uses Gmail as a command and control server Gdog is a stealthy Python Windows backdoor that uses Gmail as a command and control server. It is mostly inspired by Gcat with which it shares code base but it adds additional options and features and goes...

Uber: Self-XSS on partners.uber.com

Hi, I found a reflected XSS vulnerability in password reset page https://partners.uber.com/reset-password. I have tested this vulnerability in the latest Chrome and Firefox browsers. Reproduction Steps: 1- Go to https://login.uber.com/forgot-password and reset password. Then, Click password reset...

Zomato: Reflected XSS on business-blog.zomato.com - Part 2

Hi guys, I would like to report a reflected XSS on business-blog.zomato.com. 1. Open Chrome and Firefox latest versions 2. Open https://business-blog.zomato.com/wp-includes/js/plupload/plupload.flash.swf?target%g=alert&uid%g=hello& 3. Payload is executed Check the attached screenshot. Solution: -...

Uber: Clickjacking in love.uber.com

Hi , Your domain love.uber.com is vulnerable to Clickjacking. I'm able to load the domain love.uber.com in an iframe , so an attacker can certainly take advantage of this clickjacking bug in love.uber.com Click-jacking is a process of “stealing” clicks on your site, redirecting them to other...

Windows kernel Vulnerability CVE-2 0 1 6-0 1 4 3 analysis-vulnerability warning-the black bar safety net

4 on 2 0 March, Nils Sommer in the exploitdb on broke a new Windows kernel vulnerability PoC. The vulnerability affects all versions of Windows operating system, the attacker after the success of available privilege escalation, Microsoft in 4, on patch day fixes the vulnerability. 0×0 1...

Screenshot Easy - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Screenshot Easy published at the 'play' market has multiple vulnerabilities...

Uber: Cross-site Scripting (XSS)

The website located at https://login.uber.com/applications suffers from a stored Cross-site Scripting XSS vulnerability. Reproduction Steps: Create a new application with name as the following vector, and try to delete the same app. Vector : " Note that the XSS payload has fired. Possible...

See how I withdraw your QQ message, not fix-bug warning-the black bar safety net

0x01 Specific ideas: In with the PC end of windows chat, First you need to put the QQ chat friends window using colorful bubbles off, Then you send each other a message,right click your message, There will be a withdraw option,don't worry. point, Waiting for the other to send a message to come ov...

Uber: Reflected XSS on Uber.com careers

Location www.uber.com/careers/ Description: It is possible for an attacker to inject an arbitrary javascript into city GET parameter. This leads to phishing, defacing from URL, stealing credentials by using a fake login page and many other client side risks. POC: - Logon to...

New Relic: Basic Authorization over HTTP

Hi New Relic Team, While reviewing your host http://newrelic.com/ it was discovered that you are basic authorization over http , which is not a good practice If an attacker can intercept traffic on the network, he/she might be able to steal the user's credentials. Request:- GET /styleguide-layout...

Want WhatsApp Free Video Calling? This Leaked Screenshot Reveals Upcoming Feature

Raise your hands if you want Free Video Calling feature in WhatsApp. I am in, and I think most of you people. And the good news is that it looks like WhatsApp's much-awaited Free Video Calling feature is on its way, according to the recently leaked screenshots. Free Video Calling Feature in...

Ares - Python Botnet and Backdoor

Ares is made of two main programs: A Command aNd Control server, which is a Web interface to administer the agents An agent program, which is run on the compromised host, and ensures communication with the CNC The Web interface can be run on any server running Python. You need to install the...

Android SystemUI Information Disclosure Vulnerability

Android is a cell phone operating system based on the Linux open kernel. SystemUI in versions prior to Android 5.1.1 LMY48Z, 6.0 2015-12-01 and 6.0 2015-12-01 has a security vulnerability in its implementation, which can be exploited by remote attackers to read screenshots and then elevate...

CVE-2015-6630

CVE-2015-6630 affects Android SystemUI. The issue allows a crafted application to read screenshots and elevate privileges in affected devices. Affected software: SystemUI on Android 5.x before 5.1.1 LMY48Z and Android 6.0 before 2015-12-01. Root cause: information disclosure enabling privilege es...

CVE-2015-6630: Exposure of Sensitive Information to an Unauthorized Actor

SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to read screenshots and consequently gain privileges via a crafted application, aka internal bug 19121797...

Kaspersky AntiVirus - Certificate Handling Directory Traversal

Kaspersky AntiVirus - Certificate Handling Directory Traversal Source: https://code.google.com/p/google-security-research/issues/detail?id=539 When Kaspersky https inspection is enabled, temporary certificates are created in %PROGRAMDATA% for validation. I observed that the naming pattern is...

X (Formerly Twitter): XSS in the "Poll" Feature on Twitter.com

I have found an XSS on the "Poll" feature on Twitter.com. Payload Example: Screenshot: I have attached a screenshot in this submission in order to demonstrate the issue. Best, Mazin...

FreeBSD : shutter -- arbitrary code execution (d45ad7ae-5d56-11e5-9ad8-14dae9d210b8)

Luke Farone reports : In the 'Shutter' screenshot application, I discovered that using the 'Show in folder' menu option while viewing a file with a specially crafted path allows for arbitrary code execution with the permissions of the user running Shutter. %NASLMINLEVEL 70300 C Tenable Network...